Review: Typhon

For: Clean interface which is easy to navigate and requires no additional knowledge to use.
Against: More of a network vulnerability assessment application than an application vulnerability assessment application.
Verdict: A large number of web false positives and only one type of report availabe make this a better network vulnerability assessment utility.

The utility did not display the name of URLs found during the crawl or group the vulnerabilities by category. Typhon was fooled with the custom error pages into believing pages existed that did not.

This yielded a list of non-existent pages and directories without much detail as to actual vulnerabilities. The number of false positives reported by the utility was well over 100.

This utility would perform well as a traditional network vulnerability assessment tool, but lacks the features necessary to perform a web-based application vulnerability assessment.

A unique feature to this utility is the ability to check for other ports open (which also created additional false positive responses), as well as an included war dialer. The utility offers one level of report that is easy to read and understand for the technician.

The installation of Typhon was very simple and required only clicking "next" a few times to install the utility. Once Typhon was installed, the utility was logically laid out and included an almost unnecessary wizard to configure the scan. Typhon also uninstalled cleanly and easily leaving the systems in their original states.

Documentation for the utility comes primarily through the included help files with the utility. The files are complete and can assist an administrator with configuration troubles. The utility is simple enough to use that help files and documentation should not be necessary for most administrators.

The primary method of support is through email, with messages said to be responded to the next business day.

The pricing for Typhon was in the middle of the range of products tested at US$10,445 (unlimited IP), which included the email support. The price is a bit high for the included features, and it performs more as a network vulnerability assessment application. It is priced more for that category.

applicationassessmentsecurityvulnerability